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CLAIMS 

What is claimed is: 

1. A method for detecting a war dialing event in a telecommunications 
network, the method comprising: 

(a) analyzing signaling messages associated with calls being 
made or attempted in a telecommunications network; 

(b) based on the signaling messages, determining whether a war 
dialing event has occurred or is in progress; and 

(c) in response to determining that a war dialing event has 
occurred or is in progress, performing a war dialing event 
mitigation action. 

2. The method of claim 1 wherein analyzing signaling messages 
includes correlating the signaling messages into war dialing event 
detection call detail records including information usable for detecting 
war dialing events. 

3. The method of claim 2 wherein correlating the call signaling 
messages into war dialing event detection call detail records includes 
storing predetermined parameters from call signaling messages used 
to initiate and terminate calls. 

4. The method of claim 1 wherein analyzing signaling messages 
includes comparing calling party information in the signaling 
messages to war dialing event information stored in a database. 

5. The method of claim 1 wherein determining whether a war dialing 
event has occurred or is in progress includes receiving a call signaling 
message, extracting calling party information from the call signaling 
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message, and determining whether the calling party is a confirmed 
war dialer. 

6. The method of claim 1 wherein determining whether a war dialing 
event has occurred or is in progress includes determining whether the 
signaling messages indicate a plurality of short duration calls from the 
same calling party within a predetermined time period. 

7. The method of claim 1 wherein determining whether a war dialing 
event has occurred or is in progress includes detecting patterns of 
calls from the same calling party. 

8. The method of claim 7 wherein detecting patterns of calls includes 
detecting sequences of called party numbers dialed by the same 
calling party. 

9. The method of claim 7 wherein detecting patterns of calls includes 
detecting called party numbers dialed by the same calling party, 
wherein the called party numbers are related to each other by a 
mathematical function. 

10. The method of claim 1 wherein determining whether a war dialing 
event has occurred or is in progress includes determining whether a 
calling party number is in a predetermined war dialing exceptions list, 
and, in response to determining that the calling party number is in the 
exceptions list, determining that a war dialing event has not occurred. 

11. The method of claim 1 wherein determining whether a war dialing 
event has occurred or is in progress includes determining whether a 
war dialing calling party is making follow up calls to a previous war 
dialing event. 
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12. The method of claim 1 1 wherein determining whether the war dialing 
calling party is making follow up calls includes comparing data 
extracted from call setup messages associated with the follow up calls 
to data extracted from call setup messages associated with initial calls 

5 made by the war dialing calling party. 

13. The method of claim 1 wherein performing a war dialing event 
mitigation action includes generating a notification message in 
response to a war dialing event and sending the notification message 
to a network operations center. 

10 14. The method of claim 1 wherein performing a war-dialing event 
mitigation action includes rerouting a call associated with the war 
dialing event. 

15. The method of claim 1 wherein performing a war dialing event 
mitigation action includes blocking a call associated with the war 

15 dialing event 

16. The method of claim 15 wherein blocking the call includes sending a 
call signaling message to an end office associated with a war dialing 
calling party to block the call. 

17. The method of claim 16 wherein sending a call signaling message 
20 includes sending an ISUP address complete message (ACM) 

message to the end office, the address complete message including a 
cause code indicating that the call was blocked due to detection of a 
war dialing event. 

18. The method of claim 16 wherein sending a call signaling message 
25 includes sending an ISUP confusion (CFN) message to the end office, 
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the CFN message including a cause code indicating that the call was 
blocked due to detection of a war dialing event. 

19. The method of claim 16 wherein sending a call signaling message 
includes sending an ISUP release (REL) message to the end office, 
the release message including a cause code indicating that the call 
was blocked due to detection of a war dialing event. 

20. The method of claim 16 wherein sending a call signaling message 
includes sending an IP telephony call signaling message to the end 
office, the IP telephony call signaling message including a cause code 
indicating that the call was blocked due to detection of a war dialing 
event. 

21. The method of claim 15 wherein blocking the call includes discarding 
a call signaling message used to set up the call. 

22. The method of claim 1 comprising automatically populating a war 
dialer watch list based on detected war dialing events. 

23. A system for detecting and mitigating the war dialing events, the 
system comprising: 

(a) a war dialing event database for storing information associated 
with known or suspected war dialing calling parties; 

(b) a call detail record database for storing call detail records 
including call information usable for detecting war dialing 
events; and 

(c) a war dialing event detection function for obtaining call 
information and using the information in at least one of the war 
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dialing event and CDR databases to determine whether the call 
information is associated with a war dialing event. 

24. The system of claim 23 wherein the war dialing event database 
includes a war dialing watch list containing calling party numbers 
associated with known or suspected war dialing calling parties. 

25. The system of claim 23 wherein the war dialing event database 
includes war dialed call information including parameters associated 
with war dialed calls. 

26. The system of claim 23 wherein the war dialing event database stores 
information regarding patterns of calls from the same calling party 
number. 

27. The system of claim 23 wherein the war dialing event detection 
function is adapted to analyze CDRs stored in the CDR database to 
identify multiple short duration calls from the same calling party. 

28. The system of claim 23 wherein the war dialing event detection 
function is adapted to examine the call detail records in the CDR 
database for patterns of calls from the same calling party. 

29. The system of claim 23 wherein the war dialing event detection 
function is adapted to compare call detail records in the CDR 
database to war dialing event information in the war dialing event 
database to determine the presence of a war dialing event. 

30. The system of claim 23 comprising a correlation function for analyzing 
the information in the CDR database and the war dialing event 
database to detect follow up calls by a war dialing calling party. 
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31. The system of claim 23 comprising a war dialing event mitigation 
function for performing a war dialing mitigation action in response to 
detection of a war dialing event. 

32. The system of claim 31 wherein the war dialing event mitigation 
function is adapted to generate a notification message in response to 
detection of a war dialing event. 

33. The system of claim 32 wherein the war dialing event mitigation 
function is adapted to block calls associated with war dialing events in 
progress. 

34. The system of claim 23 comprising an exceptions database including 
information for identifying exceptions to war dialing events, wherein 
the war dialing event detection function is adapted to access the 
exceptions database in response to detecting call data relating to a 
potential war dialing event and to use the information in the 
exceptions database to determine whether the call data falls within an 
exception to a war dialing event. 

35. A computer program product comprising computer executable 
instructions embodied in a computer readable medium, the method 
comprising: 

(a) receiving call signaling messages; 

(b) analyzing the call signaling messages to identify a plurality of 
calls from the same calling party within a predetermined time 
period; 

(c) determining whether the plurality of calls indicates a war dialing 
event; and 
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(d) in response to determining that the plurality of calls indicates a 
war dialing event, performing a mitigating action. 

36. The computer program product of claim 35 wherein determining 
whether the plurality of calls indicates a war dialing event includes 
determining whether the calls each have a duration that is less than a 
predetermined value. 

37. The computer program product of claim 35 wherein determining 
whether the plurality of calls indicates a war dialing event includes 
analyzing called party numbers to determine whether the called party 
numbers are related to each other by a predetermined mathematical 
function. 

38. The computer program product of claim 35 wherein determining 
whether the plurality of calls indicates a war dialing event includes 
determining whether the calling party falls within a war dialing event 
exception. 

39. The computer program product of claim 38 comprising, in response to 
determining that the calling party falls within a war dialing event 
exception, indicating that the plurality of calls are not associated with 
a war dialing event. 

40. The computer program product of claim 35 wherein determining 
whether the plurality of calls indicates a war dialing event includes 
detecting a plurality of IAM messages having the same circuit 
identification code from the same calling party within a predetermined 
time period, wherein the IAM messages have the same circuit 
identification code. 
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41. The computer program product of claim 35 wherein determining 
whether the plurality of calls indicates a war dialing event includes 
determining whether the plurality of calls indicates a phase 1 war 
dialing event. 

42. The computer program product of claim 35 wherein determining 
whether the plurality of calls indicates a war dialing event includes 
determining whether the plurality of calls indicates a phase 2 war 
dialing event. 

43. The computer program product of claim 42 wherein determining 
whether the plurality of calls indicates a phase 2 war dialing event 
includes determining whether the calls originate from a pay phone. 

44. The computer program product of claim 35 wherein performing a 
mitigating action includes storing information in a database for 
identifying the calling party as a war dialer. 

45. The computer program product of claim 44 comprising using the 
information in the database to identify subsequent war dialing events. 

46. The computer program product of claim 35 wherein performing a war 
dialing event mitigating action includes capturing a geodesic location 
identifier parameter from a signaling message associated with a war 
dialed call and using the geodesic location identifier to locate a war 
dialer. 



